Encryption at Rest: Encrypts your data and metadata (such as file names, directory names, and directory contents) as they are written to disk. This is handled transparently using AWS Key Management Service (AWS KMS) and must be enabled when you first create the file system.

Encryption in Transit: Encrypts data as it travels between your Amazon EFS file system and your compute clients (like EC2 instances). This is achieved using Transport Layer Security (TLS) when mounting the file system.